Arbitrary SQL Execution in Asterisk Telephony Toolkit
CVE-2026-57190

7HIGH

Key Information:

Vendor

Asterisk

Status
Asterisk
Certified-asterisk
Vendor
CVE Published:
27 October 2026

What is CVE-2026-57190?

A vulnerability in the Asterisk telephony toolkit prior to specific versions may allow an attacker to execute arbitrary SQL commands via untrusted input in the CEL eventtype column when the CELGenUserEvent dialplan application is invoked. This requires that the cel_pgsql or cel_tds backend is loaded and correctly configured. It is essential for administrators to ensure that only safe data is passed to prevent unauthorized actions.

Affected Version(s)

asterisk < 20.20.1 < 20.20.1

asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3

asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1

References

https://github.com/asterisk/asterisk/security/advisories/...
x_refsource_CONFIRM
https://github.com/asterisk/asterisk/commit/046a8b0b50623...
x_refsource_MISC
https://github.com/asterisk/asterisk/commit/0a86e45e8cde7...
x_refsource_MISC

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.